Week of February 16, 2026

A research proof-of-concept shows that elevating a user-mode process to WinTcb-Light protection level via a kernel driver can prevent Microsoft Defender from terminating or remediating it, despite detection telemetry. The technique exploits the PPL signer hierarchy where WinTcb (level 6) outranks Antimalware (level 3). It is not a reliable bypass due to driver signing requirements and PatchGuard.

Google researchers discovered a malware named PromptSpy that leverages Gemini to autonomously navigate Android devices by interpreting on-screen activity and generating commands. This demonstrates AI-assisted malware capable of real-time, context-aware device manipulation, raising concerns about AI-driven endpoint threats.

A security researcher demonstrates bypassing anti-Frida and watchdog protections in the OWASP UnCrackable Level 3 Android app. The app uses native code to detect Frida and Xposed by scanning /proc/self/maps and terminates via raise(6) if found. The researcher hooks the detection function to prevent termination and then patches the tampered flag to bypass integrity checks.

CVE-2022-23278 is a spoofing vulnerability in Microsoft Defender for Endpoint's EDR sensor that could allow network-based attackers to manipulate security telemetry or impersonate trusted components. The flaw affects Windows, Linux, macOS, and Android endpoints, requiring no user interaction or privileges but with high attack complexity. Successful exploitation could undermine endpoint detection integrity across heterogeneous environments.

CVE-2025-36377 is an authentication bypass vulnerability in IBM Security QRadar EDR 3.12 through 3.12.23 caused by insufficient session expiration. Authenticated users can reuse expired session tokens to impersonate other users, potentially gaining unauthorized access to EDR management functions and sensitive security data. IBM has released patches to address the issue.

IBM Security QRadar EDR versions 3.12 through 3.12.23 use inadequate encryption strength (CWE-326), potentially allowing remote attackers to decrypt highly sensitive information. The vulnerability has high attack complexity and no known exploits in the wild. No patches are currently available.